1

Imagine your iPhone gets stolen or seized. Inside this iPhone is your SIM-Card. That SIM-Card is your only SIM-Card and it is enlisted as "trusted phone number" in your Apple Account. The iPhone is the only Apple product you own. (Note: I believe this setup is not "special" at all, but rather common.)

The attacker now takes out the SIM and puts it in another phone where the PIN/PUK is easily cracked within less than 24h. Enabling the attacker to receive recovery messages/calls.

Apple now provides account recovery based on your enlisted "trusted phone number".

I understand that the phone itself remains safe since it has its own secure password. But the Apple ID with iCloud is at risk.

What can you do to protect yourself against this scenario? Since it was the only Apple product and SIM you had, is it going to be hard to secure your Apple ID with email and password when your iPhone and SIM goes missing?

Improve this question
1
  • 1
    Note that physical access to the phone may not be required to gain access the phone number if the attacker used a sim-swap attack. Therefore it's important to set a PIN on the SIM card, which still may be cracked if physical access is gained.
    – Heng Ye
    Jun 3, 2021 at 12:44

2 Answers 2

Reset to default
1

I'm not familiar with the details of this system, but using a phone number as a single authentication factor is indeed insecure. Both device theft and SIM-swapping attacks are real, ongoing threats - some of the most famous ones included stealing iCloud accounts - and it is difficult to fully mitigate them. Putting a PIN on your SIM helps, and some mobile carriers allow you to request additional protection against SIM swaps or ports, but the best protection is to require at least two factors for authentication, ideally both more secure than a phone number.

Improve this answer
0

Attacker cannot gain access to your iPhone as it is locked with a passcode. If the attacker has your SIM, they can try to reset the password, that will not be possible due to the recovery key requirement.

Meanwhile, the password can be reset from any other device with the recovery key.

See: Two-step verification for Apple ID

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .